Commit graph

81 commits

Author SHA1 Message Date
Fomafix
dfb38d92e3 Generate valid HTML code on error pages
For img_auth.php see
http://validator.w3.org/check?uri=https%3A%2F%2Fwww.mediawiki.org%2Fw%2Fimg_auth.php;No200=1

For profileinfo.php consistently use "/>" for self-closing elements.

Change-Id: I7e6aad0e7a2a745836adc430e3b2f3be5f31b6bb
2015-02-09 12:04:05 +00:00
Aaron Schulz
4ff8136807 Removed remaining profile calls
Change-Id: I31c81c78715048004fc8fca0f27d09c1fa71c118
2015-01-08 02:49:33 -08:00
Chad Horohoe
a057356e28 img_auth: fix mismatched profiling
Change-Id: Iab2ed48ef00e55dcf5313b9c2a94ffdca2fdb790
2014-09-05 16:04:42 -07:00
umherirrender
53c420e278 Fixed spacing
- use tab as indent instead of spaces
- Added space after closures "function"
- Added spaces around string_concat
- Added newline inside empty blocks
- Removed four spaces after comma

Change-Id: I4425b0c6a69b36f40acfea6511b8950cf09ce2b2
2014-07-20 21:41:41 +02:00
Faidon Liambotis
d1c62a372a img_auth: handle files in the transcoded zone
img_auth.php does not currently handle filepaths for transcoded videos
at all, and instead falls back attempting to open files out of the
public zone, which obviously fails as these files do not exist there.

Add a branch that handles transcoded containers in the same manner as
thumbs and thus allowing access to those files from private wiki.

Bug: 65007
Change-Id: I7182206ba09dd2466fc51aa1d51116dd13db980c
2014-05-08 16:17:33 +00:00
jenkins-bot
f0d1e12ffa Merge "Avoid bogus IE extension check errors in img_auth.php" 2014-04-22 20:59:04 +00:00
jenkins-bot
a9d8a20905 Merge "Removed $wgImgAuthPublicTest" 2014-04-22 20:59:02 +00:00
Aaron Schulz
c993ec0095 Avoid uncommitted transaction notices in thumb.php and img_auth.php
bug: 56269
Change-Id: I8cf5c070899d281c7efbac853f04c2fea9374e4d
2014-04-22 15:40:42 +00:00
Aaron Schulz
a650998aa7 Avoid bogus IE extension check errors in img_auth.php
Change-Id: I57083d3fe0517b94d3b786970b412e6ec51cf5f0
2014-04-21 19:30:48 -07:00
Aaron Schulz
5252460f1d Removed $wgImgAuthPublicTest
* For public wikis, using img_auth.php cannot hurt, and thumb.php
  is already available anyway. Treat it as always "false".

Change-Id: I1240e00386a76593c37c9ac7b4c1f547c655452d
2014-04-21 13:02:27 -07:00
Aaron Schulz
0f9d78eb07 thumb.php and img_auth.php cleanups
* Specifically check isDeleted() instead of relying on the file
  being moved to the deleted zone alone.
* Made img_auth.php skip some unnecessary checks for public wikis.
  Also made it set the private cache control headers only if needed.

Change-Id: If82589acd53c02943d5f3bbafd29381fd63f8f68
2014-04-20 17:11:33 -07:00
umherirrender
9c614ac02d Fixed some @params documentation
Swapped some "$var type" to "type $var" or added missing types
before the $var. Changed some other types to match the more common
spelling. Makes beginning of some text in captial.

Change-Id: I8c9f30128b46086064326708a4878228ba459447
2014-04-14 19:52:18 +00:00
Gilles Dubuc
4d9e07056e Have ?download parameter trigger Content-Disposition: attachment
This parameter triggers Content-Disposition: Attachment which
makes the browser download the image instead of displaying it.

This is needed by Media Viewer to allow users to click a button in
order to download an image at a given resolution or the original.

Change-Id: I470a24a09139ac65588312104995e34d97a89b0f
2014-03-25 11:04:50 +01:00
Kartik Mistry
7cbd4c8c21 Use Tab instead of Space as per PHP codesniffer
Change-Id: Iea84018c3dee45d5f062b41b1337af40e3de2fcf
2014-03-15 14:31:49 +05:30
Ladsgroup
1ba0445c12 Changing URLs of mediawiki.org in scripts to the SSL-based website
http://www.mediawiki.org --> https://www.mediawiki.org

Part 2

Change-Id: I3be61fe3dfb502cc20180486eb1a8016eac151df
2014-03-12 23:24:03 +00:00
Aaron Schulz
befff4f2ef SECURITY: Added missing auth check in img_auth.php
For $wgImgAuthUrlPathMap in img_auth.php

Bug: 57016
Change-Id: I874878322a91bf14091500223d3520861a1556bb
2014-01-13 22:07:59 -08:00
Aaron Schulz
0eb5239968 Added support to img_auth.php for non-repo containers
* This adds a new $wgImgAuthUrlPathMap config variable
* Also fixed ImgAuthBeforeStream hook msg formatting

bug: 51136
Change-Id: I77528f92b20670e3b09adc79c49e62060f1614f3
2013-12-04 00:56:03 +00:00
Timo Tijhof
beb1c4a0ec phpcs: More require/include is not a function
Follows-up I1343872de7, Ia533aedf63 and I2df2f80b81.

Also updated usage in text in documentation and the
installer LocalSettingsGenerator.

Most of them were handled by this regex:
- find: (require|include|require_once|include_once)\s*\(\s*(.+?)\s*\)\s*;$
- replace: $1 $2;

Change-Id: I6b38aad9a5149c9c43ce18bd8edbab14b8ce43fa
2013-05-21 23:26:28 +02:00
Yuri Astrakhan
81551c2692 cleanup: variable referenced without initialization
declared so that IDE knows how to use it and initialized

Change-Id: I4841fd3f03220f837c981951f07c1c21ddbd76af
2013-05-15 00:43:00 +00:00
Tim Starling
1fe9340bb3 Remove hphpc support and deprecate related functions
hphpc has been superseded by hhvm, so support for hphpc is no longer
needed.

* Continue to use Preprocessor_Hash under HipHop since it is still
  faster under hhvm
* Keep $wgCompiledFiles for now, so that wikihiero doesn't give an error
  before Ic9d1e795 is merged
* Migrate the run-server script and associated configuration file to
  hhvm. Enable EnableStaticContentFromDisk since it doesn't seem
  ridiculously inefficient at first glance. Run from $IP rather than
  $IP/.. since hhvm is apparently not picky about sourcing files from
  outside of the current directory.

Change-Id: Ic3e769f1fbad4f7ad26dd819406796fee48c6b45
2013-05-09 08:28:05 +10:00
Siebrand Mazeland
655f5c6b48 Update code formatting
Change-Id: I8741b5b979e55f38a666961a16c387586a92410e
2013-02-14 13:38:19 +00:00
Antoine Musso
7006e1df93 style: fix up commas in function arguments
Fix up spaces in our function calls, we do not want spaces before a
comma and try to avoid multiple commas whenever possible.

Errors:

* No space found after comma in function call
* Space found before comma in function call

Change-Id: I51aec02016f742422fa60b92ad35ba3f0ef59ba3
2013-02-06 19:30:39 +01:00
Aaron Schulz
c43deebfd5 Simplified thumb.php for 404 handling.
* Made thumb_handler.php "just work" in a way similar to img_auth.
  It no longer needs any "handlerUrl" setting to be set.

Change-Id: I557ba1f94db3cef0f21f5c0e2b60d8e381ea3f96
2012-11-08 17:31:05 +11:00
jeroendedauw
38c7f444e1 Use __DIR__ instead of dirname( __FILE__ )
We can now do this since we finally switched to PHP 5.3 for MW 1.20 and get rid of the silly dirname(__FILE__) stuff :)

Change-Id: Id9b2c9cd2e678197aa81c78adced5d1d31ff57b1
2012-08-27 21:45:00 +02:00
Siebrand Mazeland
e4321e3e66 Replace deprecated wfMsg* calls with Message class calls.
Doing this in steps of roughly 100 changes per commit, so that it remains
reviewable.

Change-Id: Ie349afa5c809c887c787c7c04c49c9dd3478ccac
2012-08-22 21:04:12 +02:00
Alexandre Emsenhuber
f27ff698fb Added missing GPLv2 headers in some places.
Also made file documentation more consistent.

Change-Id: I30e124514396f110a572467b94ca06cefd5f7b46
2012-05-23 13:41:30 +02:00
Aaron
779f2243db Fixed use of undefined FILES_ONLY constant.
Change-Id: Icc924785cdb394adc723666bf9f6a67e9d6a4d0d
2012-04-11 11:47:15 -07:00
Platonides
9951f9f9ae trunk/phase3 is now mediawiki/core
Change-Id: Ief2721ee6573a5e54a276c91de636d9e1a678b8b
2012-03-23 17:19:22 +01:00
Sam Reed
8e78fbe32b Cleanup a few unused globals 2012-02-16 02:35:48 +00:00
Mark A. Hershberger
2d72930472 w/s 2012-02-07 13:05:31 +00:00
Tim Starling
d74aac3510 * Fix for r81363: instead of giving a PHP notice when PATH_INFO is missing, show the informative error message used before that revision.
* Revert the change to the relevant message made in r102612: it is plain text, not wikitext, a format which does not support protocol-relative URLs.
2012-02-07 03:43:23 +00:00
Aaron Schulz
5275f9b097 Merged FileBackend branch. Manually avoiding merging the many prop-only changes SVN likes to sprinkle in (easy to spot from the change list). Did not add SwiftFileBackend.php as it still is in development. 2011-12-20 03:52:06 +00:00
Robin Pepermans
be2de16942 update all core usage of deprecated Title::userCanRead() 2011-12-13 11:05:30 +00:00
Aaron Schulz
cb399e076d Reverted r105208 per CR 2011-12-06 18:48:48 +00:00
Aaron Schulz
f8d6b31bee FU r104216: keep the r103738 regex check for thumbnails but use the parent directory as the source file name. This avoids the assumption that the thumb URL starts with /thumb. 2011-12-05 19:17:44 +00:00
Aaron Schulz
22c5655da3 FU r103738: redid the method of getting the source file name for thumbnails altogether, using suggestion per CR. 2011-11-25 02:21:46 +00:00
Daniel Friesen
ae1d5aefbf Update img_auth.php and WebRequest code to handle non index.php scripts like img_auth.php better.
Also update img_auth.php so it's abuse of $wg variables is done in a way that doesn't let "/*" action paths clobber it's handling.
This should theoretically fix bug 32486.
2011-11-24 09:55:33 +00:00
Aaron Schulz
e0da5c113c image_auth.php cleanups:
* Factored main code into wfImageAuthMain()
* Made preg_match() for $name account for "page3-" type specifiers in the thumb name
* Code style cleanups
2011-11-20 08:50:13 +00:00
Sam Reed
d90b987ade Fix whitespace, braces
Fix return items
2011-10-15 22:58:42 +00:00
Chad Horohoe
1a1e917c86 Move wfStreamFile() into a class, update all callers in core (only 3 extensions use it afaict), leave wfStreamFile() as a b/c alias for now.
Yay less global functions, autoloading and less manual require()s.
2011-08-13 19:03:51 +00:00
Sam Reed
6ab399208a * (bug 29531) r89628 breaks img_auth.php
Apply Tims strpos -> strrpos fix, confirmed to work by bug reporter
2011-06-30 01:44:11 +00:00
Tim Starling
f3f1fcdc2c * Added a REQUEST_URI check to the bug 28235 handling.
* Moved most of the bug 28235 code out to a separate library class, since I was running out of distinct function names. 
* Merged the QUERY_STRING and PATH_INFO security checks, since they are dealing with the exact same problem. Removed WebRequest::isQueryStringBad(). 
* Deal with img_auth.php by having it specify what extension it expects to be streaming out. This extension can then be compared with the extension that IE might detect.
2011-06-06 11:59:20 +00:00
Tim Starling
a9b9efecb4 * Only blacklist query string extensions which match /^[a-zA-Z0-9_-]+$/. This avoids blacklisting pretty much every api.php URL with a dot in it, due to extensions like "webm&smaxage=3600&maxage=3600&format=jsonfm" being detected. Such an extension is unlikely to be registered to a dangerous file type. The proposed regex matches all extensions registered in HKEY_CLASSES_ROOT on my Windows XP VM, but does not include the ampersand, so avoids matching multiple URL parameters.
* Fixed a logic error in WebRequest::isPathInfoBad() from r88883, which caused dangerous PATH_INFO strings to be allowed as long as QUERY_STRING was set.
* Refactored the query string checks in WebRequest and img_auth.php into a single new function: isQueryStringBad().
2011-06-01 02:01:59 +00:00
Tim Starling
ff1dc8a175 HipHop improvements:
* Added the ability to compile extensions. The build process is bootstrapped by running MediaWiki in interpreted mode. Extension setup file inclusions are slightly modified in a way that makes them register themselves for compilation. Then the same LocalSettings.php uses the compiled extension setup file when the compiled binary runs.
* Tested with Cite and ParserFunctions. The code which lets you have an extensions directory in a place other than $IP/../extensions is untested.
* Simplified WebStart.php slightly by using a custom $_SERVER variable to mark compiled mode. It will break if you don't use the supplied server.conf, but that will break a lot of things so don't do that.
* Fixed the core web entry points to include WebStart.php in compiled mode instead of interpreted.
* Made the build directory configurable. This is mostly so that I can grep the source tree without seeing loads of generated C++.
* In server.conf, added a rewrite rule allowing a /wiki/$1 article path.
* Removed server.conf log file location "/dev/stdout", breaks when you switch user
* Disable static content cache, breaks horribly when you set SourceRoot to a directory containing 7GB of files.
* Rewrote the run-server script in PHP, mostly to support the configurable build directory feature.
* Added an option to the run-server script to allow running in interpreted (hphpi) mode.
2011-05-30 13:49:09 +00:00
Tim Starling
1db9197660 * Fix for bug 28534: IE 6 content type detection again
* Fix for bug 28639: user object instance cache pollution
* Release notes formatting tweak.
2011-05-05 05:29:50 +00:00
Tim Starling
7aeb423a6e (bug 28507) Fix for r85844: that revision was not actually sufficient to fix bug 28235, since URLs can have more than one question mark in them. 2011-04-14 07:10:59 +00:00
Tim Starling
3ef857fe4d Fix for bug 28235: IE6 looks for the file extension in the query string 2011-04-12 00:55:10 +00:00
Mark A. Hershberger
9de57fff82 * Remove last bit of code that uses PATH_INFO from img_auth.php so that people who want to use protected images on hosts with sadly mis-shapen PHPs (e.g. GoDaddy) can.
* Mangle PATH_INFO handler in WebRequest so that all the relevant bits are in a (couple of) static functions.
2011-02-02 01:08:15 +00:00
Mark A. Hershberger
a2ec67cfb5 Whitespace cleanup 2011-02-01 23:08:10 +00:00
Bryan Tong Minh
8008372fc6 Follow-up r65652: Do not double-slash the path if it came from PATH_INFO 2010-12-12 15:50:25 +00:00